When Encapsulating Security Payload (ESP) is used in the tunnel mode, a new IP header is computed and added. Why is this necessary? Thank you.
A tunnel wraps packets inside other packets, so you have different packet headers for the outer packets. This is true even if the tunnel is not encrypted, e.g. GRE.
In tunnel mode, the entire original IP packet is protected by IPSec or ESP. ESP is an IP protocol with a protocol number. It lacks the necessary information to be routed to the destination.
For this reason a new IP header is added, so the destination can be reached. Without an IP header, there is no way to transmit the traffic.
Short answer, ESP is not IP.